---
title: "Network policy"
description: "Secure Kubernetes workloads and hosts with Calico Enterprise network policy — extends Kubernetes NetworkPolicy with tiers, recommendations, and observability."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/network-policy/"
---

# Network policy

Writing network policies is how you restrict traffic to pods in your Kubernetes cluster. Calico Enterprise extends the standard `NetworkPolicy` object to provide advanced network policy features, such as policies that apply to all namespaces.

## Getting started

##### [Policy best practices](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-best-practices.md)

[Best practices for Calico Enterprise policy — security posture, scalability with tiers, and performance tuning under load.](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-best-practices.md)

##### [Enable a default deny policy for Kubernetes pods](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/kubernetes-default-deny.md)

[Apply a default-deny network policy in a Calico Enterprise cluster so unprotected pods are denied traffic until explicit policy is written.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/kubernetes-default-deny.md)

##### [Get started with Calico network policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md)

[Write your first Calico Enterprise NetworkPolicy — sample policies that exercise the rich rule features beyond Kubernetes NetworkPolicy.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/calico-network-policy.md)

##### [Get started with network sets](https://docs.tigera.io/calico-enterprise/latest/network-policy/networksets.md)

[Use Calico Enterprise network sets to package frequently reused IP ranges or domains into named selectors that policies can reference.](https://docs.tigera.io/calico-enterprise/latest/network-policy/networksets.md)

##### [DNS policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/domain-based-policy.md)

[Allow traffic to external destinations by DNS name using Calico Enterprise domain-based policy rules — without maintaining static IP lists.](https://docs.tigera.io/calico-enterprise/latest/network-policy/domain-based-policy.md)

##### [Recommend policies for namespaces](https://docs.tigera.io/calico-enterprise/latest/network-policy/recommendations/policy-recommendations.md)

[Run continuous Calico Enterprise policy recommendations so unprotected namespaces and workloads pick up baseline policy automatically.](https://docs.tigera.io/calico-enterprise/latest/network-policy/recommendations/policy-recommendations.md)

## Policy rules

##### [Basic rules](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/policy-rules-overview.md)

[How to write policy rules in Calico Enterprise — label selectors, source and destination match criteria, and rule actions.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/policy-rules-overview.md)

##### [Use namespace rules in policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/namespace-policy.md)

[Group or separate workloads in Calico Enterprise policy using namespaces and namespace selectors so policies apply only to specified namespaces.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/namespace-policy.md)

##### [Use service rules in policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/service-policy.md)

[Match on Kubernetes Service names in Calico Enterprise policy rules instead of specific pod selectors.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/service-policy.md)

##### [Use service accounts rules in policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/service-accounts.md)

[Match on Kubernetes service accounts in Calico Enterprise policy rules to validate workload identity and apply RBAC-controlled rules.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/service-accounts.md)

##### [Use external IPs or networks rules in policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/external-ips-policy.md)

[Restrict egress and ingress to specific IP ranges in Calico Enterprise policy, either inline or via reusable network sets.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/external-ips-policy.md)

##### [Use ICMP/ping rules in policy](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/icmp-ping.md)

[Allow or deny ICMP and ping traffic for Calico Enterprise workloads and host endpoints using policy rules.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/policy-rules/icmp-ping.md)

## Policy for hosts and VMs

##### [Protect hosts and VMs](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/protect-hosts.md)

[Protect Kubernetes hosts and bare-metal nodes with Calico Enterprise policy by writing rules that target host endpoints.](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/protect-hosts.md)

##### [Protect Kubernetes nodes](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/kubernetes-nodes.md)

[Protect Kubernetes node interfaces with Calico Enterprise host endpoints to extend network policy to the node itself.](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/kubernetes-nodes.md)

##### [Protect hosts tutorial](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/protect-hosts-tutorial.md)

[Tutorial for protecting hosts in a Calico Enterprise cluster — register host endpoints, write rules, and allow controlled access to specific Kubernetes services.](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/protect-hosts-tutorial.md)

##### [Apply policy to forwarded traffic](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/host-forwarded-traffic.md)

[Apply Calico Enterprise network policy to traffic forwarded through hosts acting as routers or NAT gateways.](https://docs.tigera.io/calico-enterprise/latest/network-policy/hosts/host-forwarded-traffic.md)

## Policy tiers

##### [Get started with policy tiers](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)

[How tiered policy works in Calico Enterprise — evaluation order, pass actions, and using tiers to enforce microsegmentation across teams.](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy.md)

##### [Change calico-system tier behavior](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/calico-system.md)

[Customize the behavior of the calico-system tier that Calico Enterprise installs by default to keep its own components reachable.](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/calico-system.md)

##### [Network policy tutorial](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/policy-tutorial-ui.md)

[Tutorial for the Calico Enterprise policy management UI — author, order, and stage policies inside tiers from the web console.](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/policy-tutorial-ui.md)

##### [Configure RBAC for tiered policies](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/rbac-tiered-policies.md)

[Configure Kubernetes RBAC to control which users can edit Calico Enterprise policies in each tier.](https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/rbac-tiered-policies.md)

## Policy for services

##### [Apply Calico Enterprise policy to Kubernetes node ports](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/services/kubernetes-node-ports.md)

[Restrict access to Kubernetes NodePort services using a Calico Enterprise GlobalNetworkPolicy at the host endpoint.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/services/kubernetes-node-ports.md)

##### [Apply Calico Enterprise policy to services exposed externally as cluster IPs](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/services/services-cluster-ips.md)

[Expose Kubernetes Service ClusterIPs over BGP using Calico Enterprise and restrict who can reach them with network policy.](https://docs.tigera.io/calico-enterprise/latest/network-policy/beginners/services/services-cluster-ips.md)

## Policy for extreme traffic

##### [Enable extreme high-connection workloads](https://docs.tigera.io/calico-enterprise/latest/network-policy/extreme-traffic/high-connection-workloads.md)

[Bypass Linux conntrack with a Calico Enterprise policy rule for workloads that handle an extreme number of concurrent connections.](https://docs.tigera.io/calico-enterprise/latest/network-policy/extreme-traffic/high-connection-workloads.md)

##### [Defend against DoS attacks](https://docs.tigera.io/calico-enterprise/latest/network-policy/extreme-traffic/defend-dos-attack.md)

[Define DoS mitigation rules in Calico Enterprise policy that drop connections at the eBPF or XDP layer, with hardware offload when available.](https://docs.tigera.io/calico-enterprise/latest/network-policy/extreme-traffic/defend-dos-attack.md)